pentesteracademy / patoolkit Goto Github PK

PA Toolkit is a collection of traffic analysis plugins focused on security

Lua 100.00%

patoolkit's Introduction

PA Toolkit (Pentester Academy Wireshark Toolkit)

PA Toolkit is a collection of traffic analysis plugins to extend the functionality of Wireshark from a micro-analysis tool and protocol dissector to the macro analyzer and threat hunter. PA Toolkit contains plugins (both dissectors and taps) covering various scenarios for multiple protocols, including:

WiFi (WiFi network summary, Detecting beacon, deauth floods etc.)
HTTP (Listing all visited websites, downloaded files)
HTTPS (Listing all websites opened on HTTPS)
ARP (MAC-IP table, Detect MAC spoofing and ARP poisoning)
DNS (Listing DNS servers used and DNS resolution, Detecting DNS Tunnels)

The project is under active development and more plugins will be added in near future.

This material was created while working on "Traffic Analysis: TSHARK Unleashed" course. Those interested can check the course here: https://www.pentesteracademy.com/course?id=42

Terms of Use

This is licensed under GPL just as Wireshark.

Installation

Steps:

Copy the "plugins" directory to Wireshark plugins directory.
Start wireshark. :)

One can get the location of wireshark plugins directory by checking Help > About Wireshark > Folders

Please opt for Personal Plugins directory and NOT the Global Plugins directory.

If you prefer Global Plugins directory, then please use this branch: https://github.com/pentesteracademy/patoolkit/tree/global-plugins

Special note for Macbook users: Paste the plugins in Personal Lua plugins and not in Personal Plugins.

Compatibility: This version is compatible with wireshark version 2.9 and later. For using patoolkit with older version of wireshark please check this branch: https://github.com/pentesteracademy/patoolkit/tree/till-2.8

Tool featured at

Blackhat Arsenal 2018 <https://www.blackhat.com/us-18/arsenal/schedule/index.html#pa-toolkit-wireshark-plugins-for-pentesters-12035>
DEF CON 26 Demolabs <https://defcon.org/html/defcon-26/dc-26-demolabs.html>

Sister Project

VoIPShark (https://github.com/pentesteracademy/voipshark)

Author

Nishant Sharma, Technical Manager, Pentester Academy <[email protected]>
Jeswin Mathai, Security Researcher, Pentester Academy <[email protected]>

Under the guidance of Mr. Vivek Ramachandran, CEO, Pentester Academy

Documentation

For more details refer to the "PA-Toolkit.pdf" PDF file. This file contains the slide deck used for presentations.

Screenshots

PA Toolkit after installation

List of websites visited over HTTP

Search functionality

Domain to IP mappings

License

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License v2 as published by the Free Software Foundation.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.

patoolkit's People

Stargazers

Watchers

Forkers

r3dfruitrollup jeswinmathai tim1512 xuacker dcmjid sh1nu11bi m00zh33 flatl1neapt gavz reydecopas kongqx ith4cker d1pakda5 mlynchcogent crypto-breaker johnjohnsp1 juan157 noktec bbhunter secuof nbilly sasqwatch attackgithub heruix xtiankisutsa chubbymaggie 13scoobie bktruss olgermolla tmatejicek luciker c002 avaudioplayer sun123qiang123 jack51706 acv147258369 raufj saleem144 sharpsec theralfbrown sandromelobrazil jh00nbr mm0x00 luwangg 0ixit chouaibhm a1kaid jayklo thinkergod ajmartel em616 liu0tufang websec123 guardianrg lazerhawk tquentin settytarun97 hbxc0re ee08b397 yolylight jimdx shuxiaa yangwj2019 02bx blue-infosec 309746069 bigbrobro f8syw5v 5l1v3r1 huamanlouyyy keyman9848 liuxing9848 polling-repo-continua chiranjibagri doanhnhq-uit b14cknc0d3 elig0n shellb0y karthicraghupathi jonz-secops evilares nishantsharmax toddmaxey l3aalteshuva sincere32 ddoadm

patoolkit's Issues

How to fix Lua problem

I have the latest version of Wireshark. I copied the "plugins" directory to Wireshark plugins directory.

Fake issue to commit images

Logo

Directories

Snapshots

dhcp_table.lua:216 bad argument #1 to 'new'

Wireshark 3.2.5
Plugins in global (global branch)
When loading wireshark (main display, no capture files):

Lua: Error during loading:
/usr/lib/wireshark/plugins/3.2/dhcp/dhcp_table.lua:216: bad argument #1 to 'new' (Field_new: a field with this name must exist)
stack traceback:
    [C]: in function 'new'
        /usr/lib/wireshark/plugins/3.2/dhcp/dhcp_table.lua:216: in function 'callback_client_table'
            /usr/lib/wireshark/plugins/3.2/dhcp/dhcp_table.lua:304: in main chunk

            Lua: Error during loading:
            /usr/lib/wireshark/plugins/3.2/web/website_lists.lua:29: bad argument #1 to 'new' (Field_new: a field with this name must exist)
            stack traceback:
                [C]: in function 'new'
                    /usr/lib/wireshark/plugins/3.2/web/website_lists.lua:29: in main chunk

                    Lua: Error during loading:
                    /usr/lib/wireshark/plugins/3.2/web/tor_detection.lua:14: bad argument #1 to 'new' (Field_new: a field with this name must exist)
                    stack traceback:
                        [C]: in function 'new'
                            /usr/lib/wireshark/plugins/3.2/web/tor_detection.lua:14: in main chunk

Create new branch compatible with Wireshark v2.9

Hi
first of all very cool Tool.
Second a small issue with Wireshark 2.9 Dev

Lua: Error during loading:
...uzona/.local/lib/wireshark/plugins/web/tor_detection.lua:14: bad argument #1 to 'new' (Field_new: a field with this name must exist)

Hole other Tools working very well only in this script I have the small problem above
maybe Wireshark 2.9 dev or my OS is the Problem or a simple Mistake in script self.

If you have some idea it was Coll otherwise I not use the tor_detection

thanks

Andre

unable to run from the global plugin folder

Hi,

I have uploaded scripts into /usr/lib64/wireshark/plugins/ and facing the problem as listed below.
Any idea what could be wrong?

Lua: Error during loading:
 ...eshark/plugins/2.6.4/patoolkit/web/tor_detection.lua:11: module 'util' not found:
	no field package.preload['util']
	no file './util.lua'
	no file '/usr/share/lua/5.1/util.lua'
	no file '/usr/share/lua/5.1/util/init.lua'
	no file '/usr/lib64/lua/5.1/util.lua'
	no file '/usr/lib64/lua/5.1/util/init.lua'
	no file '/usr/share/lua/5.1/util.lua'
	no file '/usr/share/lua/5.1/util/init.lua'
	no file './util.so'
	no file '/usr/lib64/lua/5.1/util.so'
	no file '/usr/lib64/lua/5.1/util.so'
	no file '/usr/lib64/lua/5.1/loadall.so'

Lua: Error during loading:
 ...eshark/plugins/2.6.4/patoolkit/web/post_requests.lua:13: module 'util' not found:

<skip>
Lua: Error during loading:
 ...gins/2.6.4/patoolkit/wifi/beacon_flood_detection.lua:13: module 'security' not found:
	no field package.preload['security']
	no file './security.lua'
	no file '/usr/share/lua/5.1/security.lua'
	no file '/usr/share/lua/5.1/security/init.lua'
	no file '/usr/lib64/lua/5.1/security.lua'
	no file '/usr/lib64/lua/5.1/security/init.lua'
	no file '/usr/share/lua/5.1/security.lua'
	no file '/usr/share/lua/5.1/security/init.lua'
	no file './security.so'
	no file '/usr/lib64/lua/5.1/security.so'
	no file '/usr/lib64/lua/5.1/security.so'
	no file '/usr/lib64/lua/5.1/loadall.so'

Where are the plug-ins?

Maybe I am missing something, but I cannot see any plug-ins present in this repo.